chore(security): implement strict CSP and React error boundaries

[0dillon]

Summary

The frontend is currently exposed to two critical risks: Cross-Site Scripting (XSS) vulnerabilities due to the absence of Content Security Policy (CSP) headers, and total application crashes (white screens of death) due to unhandled React exceptions.

We must harden the application. First, configure strict CSP headers in next.config.js to rigidly define script-src and connect-src, preventing any malicious script execution. Second, a global React ErrorBoundary must be wrapped around the component tree. This boundary must catch runtime exceptions, log them to our telemetry service, and present a graceful recovery UI to the merchant rather than a blank screen.

Acceptance Criteria

• Define and apply strict CSP headers in next.config.js.
• Ensure all inline scripts are properly hashed or using nonces.
• Implement a robust ErrorBoundary component with a clean fallback UI.
• Add a 'Clear Cache and Reload' recovery button to the error state.

Tech Stack

Next.js 14, React.